CVE-2021-46998: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-46998 is a use-after-free vulnerability discovered in the Linux kernel's Cisco VIC Ethernet NIC Support driver. The vulnerability affects Linux kernel versions from 4.16 up to versions before 4.19.191, 5.4.120, 5.10.38, and 5.11.22. The issue was disclosed in February 2024 and received a CVSS v3.1 base score of 7.8 (High) (NVD).

The vulnerability occurs in the enic_hard_start_xmit function when it calls enic_queue_wq_skb(). Inside enic_queue_wq_skb, if an error occurs, the skb (socket buffer) is freed by dev_kfree_skb(skb), but the freed skb is still used in skb_tx_timestamp(skb), leading to a use-after-free condition. This vulnerability is tracked as CWE-416 (Use After Free) (Kernel Patch).

The vulnerability could allow a local user with access to the affected network interface to crash the system, potentially leading to denial of service. The CVSS score of 7.8 indicates high severity impacts on confidentiality, integrity, and availability (Red Hat).

The vulnerability requires local access and low attack complexity to exploit. An attacker needs local user privileges to trigger the vulnerability through the affected network driver (NVD).

The vulnerability has been patched by modifying the enic_queue_wq_skb() function to return an error and goto spin_unlock() in case of error, preventing the use-after-free condition. The fix was provided by Govind and implemented through multiple kernel patches (Kernel Patch).